A Safe Malware Analysis Lab

Malware analysis turns an unknown file into answers: what it does, how it persists, what it talks to, and how to detect it. It’s one of the most valuable defensive skills, and one of the few where a sloppy setup can genuinely hurt you. Isolation comes first.

Live malware can escape a poorly configured lab, encrypt shared folders, and spread across networks. Never analyze samples on a work machine, a machine with personal data, or a network with other devices on it. Check your employer’s policy before analyzing samples at all.

Lab architecture

Use two virtual machines on a dedicated host-only network with no route to the internet:

VM	Role
FLARE-VM (Windows)	Detonation and analysis. Mandiant’s install script turns a Windows VM into a full analysis toolkit.
REMnux (Linux)	Network services and Linux tools. It pretends to be the internet with INetSim and FakeDNS, so samples reveal what they try to contact.

Hypervisor settings that matter:

• Disable shared folders, clipboard sharing, and drag and drop. These are bridges out of the VM.
• Use a host-only network, and confirm from inside the VM that you cannot reach the internet or your LAN.
• Snapshot a clean state after installing tools. Revert after every analysis, no exceptions.
• Keep the hypervisor patched. VM escape bugs are rare but real.

Handling samples

The industry convention is a password-protected zip with the password infected. It stops accidental execution and keeps antivirus from deleting samples in transit. Keep samples zipped everywhere except inside the analysis VM.

Reputable sources for training samples include MalwareBazaar, theZoo for historical families, and the samples bundled with books like Practical Malware Analysis. Malware-Traffic-Analysis.net offers paired samples and packet captures.

Static triage

Static analysis examines the file without running it. Start every sample here:

sha256sum sample.exe            # identify it, then search the hash on VirusTotal
file sample.exe                 # actual file type, regardless of extension
strings -n 8 sample.exe | less  # URLs, paths, registry keys, error messages

On FLARE-VM, open it in PE-bear or pestudio:

• Imports reveal capability. Networking, process injection, and crypto APIs each tell a story.
• Sections with high entropy suggest packing or encryption.
• Compile timestamp, resources, and version info sometimes identify the toolchain or author.

Run capa to map capabilities to MITRE ATT&CK techniques automatically, and FLOSS to recover obfuscated strings that strings misses.

Behavioral triage

Only after static triage, and only in the isolated VM:

1. Start Procmon with a filter for the sample’s process name, and Process Hacker or System Informer to watch process trees.
2. Start INetSim and FakeDNS on REMnux, and Wireshark on its interface.
3. Take a registry snapshot with Regshot.
4. Run the sample. Wait a few minutes. Some malware sleeps first.
5. Take the second Regshot, stop captures, and save everything outside the VM before reverting.

Look for new files, new run keys or scheduled tasks for persistence, child processes, and DNS lookups.

Turning analysis into defense

The output of analysis is detection, not just a report:

• IOCs: hashes, domains, IPs, file paths, mutex names.
• YARA rules that match the sample’s unique strings or byte patterns.
• Behavioral detections, such as Sigma rules, for the persistence and execution techniques you observed. These survive when the attacker recompiles.

Takeaway

Isolate, snapshot, triage statically, then observe behavior, and always revert. The discipline of the setup is what makes the rest of the skill safe to learn.